fix: address review feedback on HeaderAccessor bridging

- Hoist the anonymous HeaderAccessor in
  DefaultServerTransportSecurityValidator#validateHeaders(Map) into a
  named MapHeaderAccessor nested class
- Filter out null header values before findFirst() in MapHeaderAccessor
- Preserve original header name casing in
  ServerTransportSecurityValidator#toHttpHeaderValidator, matching the
  case-sensitive behavior of the removed HttpServletRequestUtils#extractHeaders
- Correct @SInCE tags on HeaderAccessor and HttpServletHeaderAccessor to 2.1.0

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: neerajbhatt

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidator.java

@@ -7,6 +7,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 import io.modelcontextprotocol.util.Assert;
 
@@ -50,22 +51,7 @@ private DefaultServerTransportSecurityValidator(List<String> allowedOrigins, Lis
 	@Override
 	@Deprecated
 	public void validateHeaders(Map<String, List<String>> headers) throws ServerTransportSecurityException {
-		validate(new HeaderAccessor() {
-			@Override
-			public List<String> getHeader(String name) {
-				return headers.entrySet()
-					.stream()
-					.filter(entry -> entry.getKey().equalsIgnoreCase(name))
-					.map(Map.Entry::getValue)
-					.findFirst()
-					.orElse(List.of());
-			}
-
-			@Override
-			public List<String> getHeaderNames() {
-				return List.copyOf(headers.keySet());
-			}
-		});
+		validate(new MapHeaderAccessor(headers));
 	}
 
 	@Override
@@ -152,6 +138,37 @@ public static Builder builder() {
 		return new Builder();
 	}
 
+	/**
+	 * {@link HeaderAccessor} view over a {@code Map<String, List<String>>}, used to
+	 * bridge the deprecated {@link #validateHeaders(Map)} to
+	 * {@link #validate(HeaderAccessor)}.
+	 */
+	private static final class MapHeaderAccessor implements HeaderAccessor {
+
+		private final Map<String, List<String>> headers;
+
+		private MapHeaderAccessor(Map<String, List<String>> headers) {
+			this.headers = headers;
+		}
+
+		@Override
+		public List<String> getHeader(String name) {
+			return headers.entrySet()
+				.stream()
+				.filter(entry -> entry.getKey().equalsIgnoreCase(name))
+				.map(Map.Entry::getValue)
+				.filter(Objects::nonNull)
+				.findFirst()
+				.orElse(List.of());
+		}
+
+		@Override
+		public List<String> getHeaderNames() {
+			return List.copyOf(headers.keySet());
+		}
+
+	}
+
 	/**
 	 * Builder for creating instances of {@link DefaultServerTransportSecurityValidator}.
 	 */

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HeaderAccessor.java

@@ -12,7 +12,7 @@
  * {@code HttpServletRequest}).
  *
  * @author Neeraj Bhatt
- * @since 0.16.0
+ * @since 2.1.0
  * @see ServerHttpHeaderValidator
  */
 public interface HeaderAccessor {

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletHeaderAccessor.java

@@ -17,7 +17,7 @@
  * For internal use only.
  *
  * @author Neeraj Bhatt
- * @since 0.16.0
+ * @since 2.1.0
  * @see HeaderAccessor
  */
 final class HttpServletHeaderAccessor implements HeaderAccessor {

mcp-core/src/main/java/io/modelcontextprotocol/server/transport/ServerTransportSecurityValidator.java

@@ -4,10 +4,9 @@
 
 package io.modelcontextprotocol.server.transport;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -40,12 +39,7 @@ static ServerHttpHeaderValidator toHttpHeaderValidator(ServerTransportSecurityVa
 		return accessor -> {
 			var collectedHeaders = accessor.getHeaderNames()
 				.stream()
-				.collect(Collectors.<String, String, List<String>>toUnmodifiableMap(String::toLowerCase,
-						accessor::getHeader, (l1, l2) -> {
-							var merged = new ArrayList<>(l1);
-							merged.addAll(l2);
-							return Collections.unmodifiableList(merged);
-						}));
+				.collect(Collectors.toUnmodifiableMap(Function.identity(), accessor::getHeader));
 			validator.validateHeaders(collectedHeaders);
 		};
 	}

mcp-core/src/test/java/io/modelcontextprotocol/server/transport/DefaultServerTransportSecurityValidatorTests.java

@@ -484,7 +484,7 @@ void noopAcceptsAll() {
 		@Test
 		void legacyValidatorAdaptsToHeaderAccessor() {
 			ServerTransportSecurityValidator legacyValidator = headers -> {
-				List<String> origins = headers.getOrDefault("origin", List.of());
+				List<String> origins = headers.getOrDefault("Origin", List.of());
 				if (!origins.isEmpty() && origins.get(0).contains("evil")) {
 					throw new ServerTransportSecurityException(403, "Invalid Origin header");
 				}